Correlating radio access network messages of aggressive mobile devices

Abstract

Excessive signaling by devices against a radio access network (RAN) can be detected and mitigated. A security management component (SMC) can determine whether a total number of control signals received by a base station from devices satisfies a threshold total number of control signals indicative of excessive signaling. If so, SMC can identify a device associated with the base station based on analyzing communication conditions associated with the device. SMC can determine whether to classify the device as an excessive signaling device based on whether the number of control signals received from the device by the base station satisfies a threshold number of control signals indicative of excessive signaling. If so, SMC can determine the device is an excessive signaling device. In response, SMC can perform or facilitate performing a mitigation action to mitigate excessive signaling or can generate statistics relating to the excessive signaling.

What is claimed is: 
     
       1. A method, comprising:
 identifying, by a system comprising a processor, a device associated with a base station based on communication conditions associated with the device; 
 obtaining, by the system, device type information associated with the device; and 
 determining, by the system, whether to classify the device as an excessive signaling device based on an amount of control signals determined to be received from the device by the base station, the device type information associated with the device, and a defined communication management criterion that relates to excessive signaling. 
 
     
     
       2. The method of  claim 1 , further comprising:
 analyzing, by the system, a group of control signals received from devices, comprising the device, during a defined period of time, wherein the devices are associated with the base station; and 
 based on the analyzing, determining, by the system, whether a total amount of control signals of the group of control signals received from the devices during the defined period of time satisfies a defined threshold total amount of control signals associated with the base station, wherein the defined threshold total amount of control signals relates to whether any device of the devices potentially is the excessive signaling device in accordance with the defined communication management criterion. 
 
     
     
       3. The method of  claim 2 , further comprising:
 in response to determining that the total amount of control signals of the group of control signals satisfies the defined threshold total amount of control signals associated with the base station:
 identifying, by the system, at least one of the devices associated with the base station based on respective communication conditions associated with the at least one of the devices, wherein the identifying of the at least one of the devices comprises the identifying of the device; and 
 determining, by the system, whether any device of the devices satisfies a defined threshold amount of control signals that indicates the excessive signaling, in accordance with the defined communication management criterion. 
 
 
     
     
       4. The method of  claim 1 , further comprising:
 receiving, by the system, information relating to connectivity and mobility events, signal power, and signal quality associated with the base station and devices associated with the base station over a specified time period, wherein the connectivity and mobility events comprise control signals associated with the devices; 
 analyzing, by the system, the information; 
 determining, by the system, a profile of the base station based on a result of the analyzing of the information; and 
 determining, by the system, a defined threshold amount of control signals that indicates the excessive signaling or a defined threshold total amount of control signals associated with the base station based on the profile. 
 
     
     
       5. The method of  claim 1 , further comprising:
 in response to determining that the amount of control signals determined to be received from the device during a defined time period satisfies a defined threshold amount of control signals that indicates the excessive signaling, determining, by the system, that the device is to be classified as the excessive signaling device, wherein the defined threshold amount of control signals is determined in accordance with the defined communication management criterion. 
 
     
     
       6. The method of  claim 5 , wherein the defined communication management criterion is a first defined communication management criterion, and wherein the method further comprises:
 in response to classifying the device as the excessive signaling device, determining, by the system, a mitigation action to perform to facilitate mitigating the excessive signaling associated with the device based on the amount of control signals determined to be received from the device and based on a second defined communication management criterion relating to excessive signaling mitigation. 
 
     
     
       7. The method of  claim 6 , further comprising:
 performing, by the system, the mitigation action, wherein the performing of the mitigation action comprises:
 logging information relating to the device; 
 communicating an alert message to a messaging account or an interface associated with a user identity, wherein the alert message presents information that relates to the excessive signaling by the excessive signaling device; 
 initiating a blocking of the device from connecting to or communicating via a group of base stations comprising the base station; or 
 initiating throttling of the device to block a portion of attempts by the device to connect to or communicate with the group of base stations. 
 
 
     
     
       8. The method of  claim 7 , further comprising:
 to facilitate the blocking of the device, determining, by the system, a first range of signal quality values associated with the device, a second range of signal strength values associated with the device, or a third range of timing advance values associated with the device, based on an analysis of the communication conditions associated with the device, 
 wherein the initiating of the blocking of the device comprises initiating blocking of at least one of the devices that is determined to have a signal quality value within the first range of signal quality values, a signal strength value within the second range of signal strength values, or a timing advance value within the third range of timing advance values, and wherein the at least one of the devices comprises the device. 
 
     
     
       9. The method of  claim 5 , further comprising:
 in response to classifying the device as the excessive signaling device, performing at least one of:
 determining, by the system, an exception level associated with the device based on a defined threshold exception value, wherein the exception level indicates a criticality associated with the excessive signaling by the device; 
 determining, by the system, an exception trend associated with the device based on an analysis of information relating to communication of the control signals by the device, wherein the exception trend indicates
 an upward trend, a downward trend, or an unknown trend in the communication of the control signals by the device, or 
 a stable condition regarding the communication of the control signals by the device; 
 
 determining, by the system, a statistic relating to periodic communication of the control signals by the device, wherein the statistic comprises an average amount of control signals communicated by the device over a specified time period or a variance in a frequency of the communication of the control signals by the device during the specified time period; 
 determining, by the system, respective start times and respective end times associated with the determining of the exception trend or the statistic; or 
 determining, by the system, a confidence level associated with the determination that the device is the excessive signaling device. 
 
 
     
     
       10. The method of  claim 1 , further comprising:
 determining, by the system, a group of configuration parameters associated with the device, wherein the group of configuration parameters comprises a quality of service class identifier, an allocation and retention priority parameter, a mobility management entity or access management function code, a mobility management entity or access management function group identifier, or a band frequency associated with the device, 
 wherein the determining whether to classify the device as the excessive signaling device comprises determining whether to classify the device as the excessive signaling device based on the amount of control signals and the group of configuration parameters associated with the device. 
 
     
     
       11. The method of  claim 1 , further comprising:
 determining, by the system, a group of configuration parameters associated with the device, wherein the group of configuration parameters comprises a quality of service class identifier, an allocation and retention priority parameter, a mobility management entity or access management function code, a mobility management entity or access management function group identifier, or a band frequency associated with the device, 
 wherein the identifying comprises identifying the device associated with the base station based on the communication conditions associated with the device and the group of configuration parameters associated with the device. 
 
     
     
       12. The method of  claim 1 , wherein the control signals comprise at least one of an attach request signal to request an attachment to the base station, an update attach request signal relating to the attachment to the base station, an authentication update request relating to the attachment to the base station, a packet data network gateway update request relating to the attachment to the base station, a connection request signal to request a connection to the base station, or a handover-related signal associated with a handover of the device to or from the base station. 
     
     
       13. The method of  claim 1 , further comprising:
 determining, by the system, the communication conditions based on a received signal strength indicator value, a received signal received power value, a received signal received quality value, a channel quality indicator, a signal to interference and noise ratio value, or a timing advance value associated with the device. 
 
     
     
       14. A system, comprising:
 a processor; and 
 a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
 identifying a user equipment associated with a base station based on communication conditions associated with the user equipment; 
 receiving user equipment type data indicative of a user equipment type of the user equipment; and 
 determining whether to classify the user equipment as aggressive signaling user equipment based on a number of control signals determined to be received from the user equipment by the base station, the user equipment type of the user equipment, and a defined communication management criterion that indicates what constitutes aggressive signaling. 
 
 
     
     
       15. The system of  claim 14 , wherein the operations further comprise:
 evaluating a group of control signals received from a group of user equipment, comprising the user equipment, during a defined period of time, wherein the group of user equipment is associated with the base station; and 
 based on a result of the evaluating, determining whether a total number of control signals of the group of control signals received from the group of user equipment during the defined period of time satisfies a defined threshold total number of control signals associated with the base station, wherein the defined threshold total number of control signals relates to whether any user equipment of the group of user equipment potentially is the aggressive signaling user equipment. 
 
     
     
       16. The system of  claim 15 , wherein the operations further comprise:
 in response to determining that the total number of control signals of the group of control signals satisfies the defined threshold total number of control signals associated with the base station:
 identifying at least one user equipment of the group of user equipment based on respective communication conditions associated with the at least one user equipment, wherein the identifying of the at least one user equipment comprises the identifying of the user equipment; and 
 determining whether any user equipment of the group of user equipment satisfies a defined threshold number of control signals that indicates the aggressive signaling, in accordance with the defined communication management criterion. 
 
 
     
     
       17. The system of  claim 14 , wherein the operations further comprise:
 in response to determining that the number of control signals determined to be received from the user equipment during a defined time period satisfies a defined threshold number of control signals that indicates the aggressive signaling, determining that the user equipment is to be classified as the aggressive signaling user equipment, wherein the defined threshold number of control signals is determined in accordance with the defined communication management criterion. 
 
     
     
       18. The system of  claim 14 , wherein the defined communication management criterion is a first defined communication management criterion, and wherein the operations further comprise:
 in response to classifying the user equipment as the aggressive signaling user equipment:
 determining a mitigation action to perform to facilitate mitigating the aggressive signaling associated with the user equipment based on the number of control signals determined to be received from the user equipment and based on a second defined communication management criterion relating to aggressive signaling mitigation; or 
 determining a group of statistics relating to the aggressive signaling associated with the user equipment or the base station, wherein the group of statistics relates to a trend in communication of the control signals, an exception level that indicates a criticality associated with the aggressive signaling associated with the user equipment or associated with the base station, an average number of control signals communicated by the user equipment over a specified time period, a variance in a frequency of the communication of the control signals by the user equipment during the specified time period, or a confidence level of the determination that the user equipment is the aggressive signaling user equipment. 
 
 
     
     
       19. A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
 identifying a user equipment associated with network equipment based on communication conditions associated with the user equipment; 
 determining a group of configuration parameters associated with the user equipment; and 
 determining whether to classify the user equipment as excessive signaling user equipment based on an amount of signals determined to be received from the user equipment by the network equipment, the group of configuration parameters associated with the user equipment, and a defined threshold amount of signals that is indicative of excessive signaling. 
 
     
     
       20. The non-transitory machine-readable medium of  claim 19 , wherein the operations further comprise:
 in response to determining that the amount of control signals determined to be received from the user equipment during a defined time period satisfies the defined threshold amount of control signals, determining that the user equipment is to be classified as the excessive signaling user equipment, wherein the defined threshold amount of control signals is determined in accordance with a first defined communication management criterion; and 
 in response to classifying the user equipment as the excessive signaling user equipment:
 determining a mitigation action to perform to facilitate mitigating the excessive signaling associated with the user equipment based on the amount of control signals determined to be received from the user equipment and based on a second defined communication management criterion relating to excessive signaling mitigation, or 
 determining a group of statistics relating to the excessive signaling associated with the user equipment or the network equipment, wherein the group of statistics relate to a trend in communication of the control signals, an exception level that indicates a criticality associated with the excessive signaling associated with the user equipment or associated with the network equipment, an average amount of control signals communicated by the user equipment over a specified time period, a variance in a frequency of the communication of the control signals by the user equipment during the specified time period, or a confidence level associated with the determination that the user equipment is the excessive signaling user equipment.